registry / @rmyndharis/aimhooman / 0.1.5

@rmyndharis/aimhooman@0.1.5

AI works. Hoomans ship. Keep AI session files, secrets, and attribution out of your commits.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installed agent adapters can invoke the local CLI at session start and before tool use. The hook can update `.git/info/exclude` and deny selected tool actions; explicit CLI initialization can install Git dispatchers.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Enabling a bundled agent plugin, or explicitly running `aimhooman init` / `aimhooman init --global --yes`.

Impact

Can alter repository-local Git hygiene state and block agent tool calls or commits; no exfiltration or remote payload execution was confirmed.

Mechanism

First-party AI-agent hook enforcement and optional Git hook installation.

Rationale

This is a package-owned agent extension with automatic local enforcement and optional Git-wide hook configuration, creating a meaningful control-surface risk. The source shows no concrete malicious chain or unconsented npm install-time mutation.

Evidence

package.jsonhooks/hooks.json.github/hooks/aimhooman.jsonsrc/hook.mjssrc/githooks.mjsbin/aimhooman.mjs.git/info/exclude.git/hooks/*~/.aimhooman/hooks/*~/.gitconfig

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`hooks/hooks.json` runs the package CLI on Claude `SessionStart` and every `PreToolUse`.
`.github/hooks/aimhooman.json` invokes `aimhooman hook pre-tool-use` for all matching Copilot tool calls.
`src/hook.mjs` automatically updates a repository exclude file at session start and can emit tool permission denials.
`bin/aimhooman.mjs` supports explicit `init --global --yes`, writing managed hooks and Git's global `core.hooksPath`.

Evidence against

`package.json` has no preinstall, install, postinstall, or other lifecycle hook.
No runtime HTTP/network client was found in executable source; URLs are metadata/schema identifiers.
Git subprocess use is argv-based via `execFileSync`, primarily for repository inspection and hook configuration.
Global hook setup requires the user to run `aimhooman init --global --yes` and refuses foreign existing hook paths.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 403 KB of source

Source & flagged code

4 flagged

CHANGELOG.mdView file

Lines 1-33markdown

1# Changelog

2

3All notable changes to this project are documented in this file.

4

5The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),

6and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

7

Source & flagged code

4 flagged · loading source

CHANGELOG.mdView file

13patternName = aws_access_key severity = critical line = 13 matchedText = `AKIA…`/... AWS

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L13

13patternName = aws_access_key severity = critical line = 13 matchedText = `AKIA…`/... AWS

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L13

src/hook.mjsView file

1883function [redacted](tokens, payload, initialCwd) { L1884: if (!/(?:^|[^A-Za-z0-9_])eval(?:[^A-Za-z0-9_]|$)|\$(?:[@*]|[1-9][0-9]*)/.test(payload)) { L1885: return null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/hook.mjsView on unpkg · L1883

Findings

2 Critical1 High1 Medium4 Low

CriticalCritical SecretCHANGELOG.md

CriticalSecret PatternCHANGELOG.md

HighPrevious Version Dangerous Deltabin/aimhooman.mjs

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/hook.mjs

LowFilesystem

LowHigh Entropy Strings

LPM CLI

bin/aimhooman.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rmyndharis/aimhooman@0.1.4 matchedIdentity = npm:QHJteW5kaGFyaXMvYWltaG9vbWFu:0.1.4 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/aimhooman.mjsView on unpkg

Entrypointsbin → aimhooman

Runtimenode >=22.8.0

Artifact2.91 MB · 54 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: check, check:static, sync:hosts, sync:ruleset +3

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemShellHighEntropyStringsManifest: clean

Source & flagged code

4 flagged

CHANGELOG.mdView file

Lines 1-33markdown

1# Changelog

2

3All notable changes to this project are documented in this file.

4

5The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),

6and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

7

8## [0.1.5] - 2026-07-18

9

10### Fixed

11

12- AWS's own published example key no longer blocks a commit. 0.1.4 began matching bare

13 `AKIA…`/`ASIA…` access key IDs, which also matched `AKIAIOSFODNN7EXAMPLE` — the value AWS

Critical

Critical Secret

Package contains a critical-looking secret pattern.

CHANGELOG.mdView on unpkg · L13

Critical

Secret Pattern

AWS access key ID in CHANGELOG.md

CHANGELOG.mdView on unpkg · L13

14 prints in its own documentation, and one that lands in READMEs, Terraform samples, and test

15 fixtures. Because the rule's category is `secret`, neither a rule allow nor a plain path

16 allow is accepted, so a documentation example became an unconditional block on every profile

17 with only a per-file escape. Every AWS example key ends in `EXAMPLE`, so the pattern now

18 excludes that suffix and keeps blocking real keys. Path scoping was deliberately not used:

19 excluding `docs/` or `tests/` from secret scanning would hide genuine keys in the places they

20 most often leak.

21- `uninstall --purge-state` no longer leaves a backup behind in a linked worktree. Git writes

22 the commit message file into the per-worktree Git directory, so 0.1.4's sweep — which looked

23 only in the common directory — printed "state purged" with `COMMIT_EDITMSG.aimhooman-bak`

24 still on disk. Uninstall disarms every worktree at once, so it now sweeps the main Git

25 directory and each linked one, and matches the `.aimhooman-bak` suffix so a backup left by a

26 merge goes with it.

27- A plain `uninstall` keeps the attribution backup. It printed "state kept" and then deleted

28 the one file holding the lines stripped from the last commit message. Only `--purge-state`,

29 which promises to remove everything, takes it now.

30- Sweeping an empty lock queue can no longer stop a concurrent `aimhooman init`. Between its

31 `mkdir` and its first publication a lock contender owns no file in the queue, so the sweep

32 saw an empty directory and removed it, and the contender then failed on a bare `ENOENT`. The

33 window is wide enough to lose because building the candidate probes the process identity,

src/hook.mjsView file

Lines 1863-1903javascript

1863function nestedShellStartupTargetUncertain(tokens) {

1864 const executable = shellExecutable(tokens[0]);

1865 if (['csh', 'elvish', 'fish'

bin/aimhooman.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rmyndharis/aimhooman@0.1.4 matchedIdentity = npm:QHJteW5kaGFyaXMvYWltaG9vbWFu:0.1.4 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/aimhooman.mjsView on unpkg

,

'nu'

,

'tcsh'

].

includes

(executable))

return

true

;

1866 for (let index = 1; index < tokens.length; index++) {

1867 const option = tokens[index];

1868 if (option === '--' || option === '-c') break;

1869 if (/^-[^-]*c/.test(option)) {

1870 return /^-[^-]*[il]/.test(option);

1871 }

1872 if (['--init-file', '--rcfile'].includes(option)

1873 || option.startsWith('--init-file=')

1874 || option.startsWith('--rcfile=')) return true;

1875 if (option === '-C' && executable === 'fish') return true;

1876 if (/^-[^-]*[il]/.test(option)) return true;

1877 if (['-O', '-o'].includes(option)) index += 1;

1878 else if (!option.startsWith('-')) break;

1879 }

1880 return false;

1881}

1882

1883function nestedShellArgumentCommitInvocation(tokens, payload, initialCwd) {

1884 if (!/(?:^|[^A-Za-z0-9_])eval(?:[^A-Za-z0-9_]|$)|\$(?:[@*]|[1-9][0-9]*)/.test(payload)) {

1885 return null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/hook.mjsView on unpkg · L1883

1886 }

1887 const payloadIndex = tokens.indexOf(payload);

1888 if (payloadIndex < 0 || payloadIndex === tokens.length - 1) return null;

1889 return literalCommitDetails(tokens.slice(payloadIndex + 1).join(' '), initialCwd);

1890}

1891

1892// Shell nesting, pipelines, background jobs, and command substitution change

1893// cwd/execution scope in ways a non-executing parser cannot prove. A commit in

1894// such a command is denied by the agent guard and can be retried as a direct

1895// Git command, while ordinary `a && b`/`a || b` chains remain supported.

1896function hasUncertainShellSyntax(command) {

1897 let quote = '';

1898 let escaped = false;

1899 for (let i = 0; i < command.length; i++) {

1900 const char = command[i];

1901 if (escaped) {

1902 escaped = false;

1903 continue;